GDPR Information and Data Protection Rights

1. When the GDPR Applies

The GDPR may apply to EduCase activities involving individuals in the European Economic Area (EEA), including where goods or services are offered to individuals in the EEA or their behavior is monitored there. Applicability depends on the specific processing activity and legal circumstances; it does not arise solely because someone has European citizenship.

This page describes our approach to GDPR-related obligations where applicable. It is not a representation that every EduCase activity is subject to GDPR, or a declaration of regulatory certification.

2. Who Controls Your Information?

Institutional programs: When a university, hospital, medical society, workshop organizer, residency program, or examination authority determines why and how learner or candidate records are used, that organization will generally act as a data controller. EduCase may act as its data processor when handling those records under documented instructions. The precise allocation of responsibilities depends on the engagement and any applicable data processing agreement.

EduCase's own activities: RadOnc eLearning Center, LLC generally determines the purposes of processing for its own account administration, direct customer relationships, billing, website operations, and certain security and support activities, and may act as a controller for those activities.

Where a request concerns institution-controlled examination results, we may refer it to the institution or assist the institution in responding. We do not independently alter official examination results or disclose records contrary to authorized controls.

3. Categories of Personal Data

Depending on the Services used, personal data may include:

• Name, email address, professional affiliation, job title, contact details, and account identifiers.
• Login records, IP addresses, device information, cookies, security and support logs.
• Course enrollment, access dates, assignment activity, clinical contour submissions, quiz answers, performance metrics, scores, faculty comments, and examination records.
• Purchasing, invoicing, and transaction information; payment details may be processed by authorized payment providers.
• Communications with our staff and authorized administrators.

Some usage information may be pseudonymized but still qualifies as personal data if it can be linked to a person. Truly anonymized information that cannot reasonably identify an individual is outside the GDPR's personal-data rules.

4. Purposes and Lawful Bases

Where EduCase acts as controller, processing may rely on one or more applicable GDPR lawful bases:

• Contract: establishing accounts and delivering requested products or services when processing is necessary for a contract with the individual.
• Legitimate interests: maintaining platform security, preventing misuse, managing relevant business communications, and improving service reliability, after assessing affected individuals' interests and rights.
• Legal obligation: maintaining records and responding to legally required requests.
• Consent: where legally required, such as particular optional marketing communications or nonessential cookies. Consent may be withdrawn at any time without affecting prior lawful processing.

For an institution-controlled course or examination, the institution determines and documents the relevant lawful basis for its processing. EduCase processes on its documented instructions where acting as processor. The lawful basis is assessed for each purpose; consent is not automatically the basis merely because a person uses the platform.

5. Clinical Cases and Sensitive Information

EduCase is designed for education, including radiation oncology imaging and contouring exercises. Organizations submitting DICOM or other clinical data are expected to ensure appropriate de-identification, permissions, and lawful disclosure before upload.

Medical imaging or associated records that identify a patient may involve special-category health data and require both an Article 6 lawful basis and an applicable Article 9 condition, together with appropriate safeguards. EduCase users should not upload identifiable patient information unless an appropriate written arrangement and lawful processing basis are in place.

EduCase does not treat mere de-identification labels as conclusive proof of anonymity. Institution-provided clinical cases are not automatically licensed for unrelated research, sale, or external AI model training.

6. Your GDPR Rights

Where the GDPR applies, and subject to its conditions and exceptions, individuals may have rights to:

• Be informed: understand how and why their personal data are processed.
• Access: obtain confirmation and a copy of personal data concerning them.
• Rectification: correct inaccurate data or complete incomplete data.
• Erasure: request deletion where the legal requirements are met.
• Restriction: limit certain processing in specified circumstances.
• Portability: receive applicable data in a structured, commonly used, machine-readable format and transmit it to another controller where the legal criteria are met.
• Object: object to processing based on legitimate interests or certain other grounds, including direct marketing.
• Withdraw consent: where processing is based on consent.
• Safeguards for automated decisions: contest qualifying solely automated decisions with legal or similarly significant effects, as set out in Article 22.

These rights are not absolute. For example, lawful retention duties, the rights of other candidates, assessment integrity, or an institution's statutory responsibilities may affect the scope of a request.

7. How to Exercise Your Rights

Submit a request using the contact details in our Privacy Policy or our website contact channel. Identify the account or program involved and describe the right you wish to exercise. Do not send passwords, identity documents, or patient information in an initial message.

We may ask for information reasonably necessary to verify identity and prevent unauthorized disclosures. If an institution controls the relevant data, we will route the request as appropriate or work with the institution to facilitate its response.

When acting as controller, we will respond without undue delay and generally within one month of receiving a valid request. Where GDPR permits, this period may be extended by up to two additional months due to complexity or the number of requests, with notice within the initial month. Requests are generally free of charge, subject to the GDPR's limited exceptions for manifestly unfounded or excessive requests.

8. Authorized Recipients and Service Providers

Personal information may be made available to authorized institutional administrators, faculty, examination authorities, and service providers to the extent needed for the applicable program or business purpose. These may include hosting, email, support, analytics, and payment providers.

Where required, we use contractual arrangements with processors that address confidentiality, security, instructions, subprocessors, assistance with individual rights, and deletion or return of information. Institution-facing permissions and reporting rights are governed by the program configuration and applicable agreement. EduCase does not sell personal data as part of its educational services.

9. International Transfers

EduCase operates internationally, and information may be hosted, accessed, or otherwise processed outside the EEA, including in the United States and other locations used by authorized providers or client programs.

Where GDPR Chapter V applies to a transfer, the relevant controller or processor must identify an appropriate transfer mechanism. Depending on the circumstances, this may involve an adequacy decision, the European Commission's Standard Contractual Clauses (SCCs) with supplementary measures where required, or a valid statutory derogation for a specific situation.

Using the platform does not, by itself, constitute blanket consent to all international transfers. The applicable transfer mechanism and hosting arrangements should be identified in relevant institutional documentation where necessary.

10. Retention, Export, and Deletion

Personal information is kept only as long as necessary for the relevant purposes, contractual commitments, lawful retention requirements, or defensible legal interests. Specific periods may differ for account records, assessment results, billing records, operational logs, and backups.

For institutional programs, the applicable Service Agreement or data processing agreement may specify a retention schedule and arrangements for exporting, returning, or deleting program data. Requests for export should be made before an agreed access period ends.

Deletion from active systems does not necessarily mean immediate erasure of all backup copies. Backup deletion follows the applicable verified backup retention cycle, subject to lawful preservation requirements. We will not promise a fixed backup expiration or certified deletion period unless it has been confirmed and expressly agreed.

11. Security and Personal Data Breaches

EduCase uses organizational and technical safeguards appropriate to the risks associated with its processing. Safeguards may include access restrictions, user authentication, monitoring, system maintenance, and other controls described in relevant security documentation. No online system is risk-free.

When EduCase acts as processor, it will notify the institutional controller of a personal data breach without undue delay after becoming aware of it, consistent with the applicable agreement and Article 33. Where EduCase acts as controller, it will assess regulatory notification duties; a reportable breach generally must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness. Affected individuals will be informed when required, including where a breach is likely to result in a high risk to their rights and freedoms.

Incident reporting obligations should not be confused with system-availability or disaster-recovery guarantees, which must be specified separately where required.

12. Educational Scoring and Automated Decisions

EduCase tools may produce contour comparison metrics, scores, learning analytics, or other computer-generated feedback. Such educational measurements do not necessarily constitute automated decision-making under Article 22 GDPR.

The relevant institution, examination authority, or faculty is responsible for defining assessment criteria and determining how results are used. If a program proposes solely automated decisions that have legal or similarly significant effects on individuals, the responsible controller must assess the applicable restrictions, lawful exceptions, and safeguards, including any required human intervention or rights to contest the outcome.

13. Cookies and Website Analytics

EduCase may use necessary cookies for account authentication, security, and site functionality, and optional analytics or other technologies where enabled. Where applicable law requires consent for nonessential cookies or similar tracking technologies, these should not be activated before valid consent is obtained. See the Privacy Policy and any available cookie controls for further details.

14. EU Representative and Data Protection Contacts

Because RadOnc eLearning Center, LLC is organized in the United States, an EU representative may be required under Article 27 when the GDPR's extraterritorial rules apply, unless a relevant exception applies. The company must assess this requirement based on its actual processing and activities.

EU representative: Details will be published here if a representative is required and formally designated. This page does not imply an appointment has already been made.

Likewise, any requirement to appoint a Data Protection Officer (DPO) depends on the statutory criteria and should not be assumed solely because EduCase provides medical education services.

15. Complaints and Supervisory Authorities

We encourage you to contact EduCase or your institutional controller about privacy concerns so they can be investigated. Where the GDPR applies, you may also lodge a complaint with a competent data protection supervisory authority, particularly in the EEA country where you habitually reside, work, or believe an infringement occurred. You may have additional judicial remedies under applicable law.

16. Contact, Related Policies, and Updates

Related documents: Privacy Policy and Terms of Use. We may update this information to reflect changes in law, processing practices, or contractual procedures. Material updates will be identified by a revised date and communicated when required.

This GDPR information page provides explanatory information and does not replace a signed institutional Service Agreement, an applicable data processing agreement, or legal rights arising under mandatory law.